Allow downloads only during unmetered hours?

In your router's settings, set up a block (using Access Restrictions or similar in the router's web interface) to mesu.apple.com. This will prevent the devices from "phoning home" to Apple, checking for updates and getting the download(s) pushed to the device

In the future to check for updates on the device, simply disable the Access Restriction block created above. After you've checked for updates, remember to reenable the Access Restriction block that you disabled.

This is one aspect of Apple's operations that I simply detest. If I want the update, I'll download it when and if I decide to download it. Apple will push the update to you when they please unless you block it yourself.